V1.20 reports not consistent with scout.docker.com

Open

#232 opened on Jun 14, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 38/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Quiet
Tech stack: docker, shell
Domain: cli, security

Research direction

Reproduce the reports with the shown docker scout cves and docker scout vex get commands for darkedges/pingaccess:8.3.4-hi. Compare the web result, CLI output, and the locally loaded pa-vex.json, then inspect the linked VEX statements. Done means identifying why the views differ and documenting or correcting the inconsistent behavior.

Written by the indexing model from the issue text.

Description

Take a look at https://scout.docker.com/reports/org/darkedges/images/host/hub.docker.com/repo/darkedges%2Fpingaccess/tag/8.3.4-hi/digest/sha256%3Aecc648a974434c9cc9bdafe6fa32563a7a8c3f8ec8b4c52dc969216a477d4487/exceptions

it reports

but when ran via the comand line

docker scout cves darkedges/pingaccess:8.3.4-hi              
    i New version 1.21.0 available (installed version is 1.20.0) at https://github.com/docker/scout-cli
    v SBOM obtained from attestation, 278 packages found
    v Provenance obtained from attestation
    v VEX statements obtained from attestation
    x Detected 29 vulnerable packages with a total of 52 vulnerabilities

When I get an use the vex locally

docker scout vex get darkedges/pingaccess:8.3.4-hi --output pa-vex.json
    i New version 1.21.0 available (installed version is 1.20.0) at https://github.com/docker/scout-cli
    v SBOM obtained from attestation, 278 packages found
    v Provenance obtained from attestation
    v Found 53 VEX attestations for image
    v Report written to pa-vex.json

docker scout cves darkedges/pingaccess:8.3.4-hi --vex-location pa-vex.json
    i New version 1.21.0 available (installed version is 1.20.0) at https://github.com/docker/scout-cli
    v SBOM obtained from attestation, 278 packages found
    v Provenance obtained from attestation
    v Loaded 1 VEX document
    v VEX statements obtained from attestation
    x Detected 8 vulnerable packages with a total of 6 vulnerabilities

it appears that I am not able to get a consistent view.

CLI without a local vex shows all vulnerability despites having a status of not affected [vulnerable code not in execute path]
CLI with local vex extract from container shows more vulnerabilities than the web interface.

Vex Statements are at https://github.com/darkedges/trivy-vex-demo/blob/main/vex/statements-scout-darkedges/

Dominant language: Shell
Stars: 454
Forks: 134
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Add 4.2.2 Kafka version Open

good-start

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

strimzi/test-container-images#71 · Opened Sep 23, 2026
[Chore] Keep one viget-block-generator skill and replicate it, instead of four tracked copies Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

vigetlabs/wordpress-site-starter#290 · Opened Sep 23, 2026
Include Proactivity in the BMAD FR/NFR breadth gate Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

VilnaCRM-Org/user-service#497 · Opened Sep 23, 2026
import spacy fails with ModuleNotFoundError: No module named 'click' Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

conda-forge/spacy-feedstock#177 · Opened Sep 23, 2026
New cross-tree layering dependency: jail/ -> proxy/ (build_ca_bundle.py) Open

area:jail bug security severity:low track:open-source

Difficulty 1/5 Under an hour Newbie friendliness 75/100

ntindle/spark-vm#304 · Opened Sep 23, 2026

More Shell/Bash issues